@redacto.io/consent-sdk-react 10.0.0-beta.0 → 10.0.0-beta.11

package/src/RedactoPrivacyCenter/components/SelectUserGate.tsx

@@ -0,0 +1,195 @@
+import {
+  useCallback,
+  useEffect,
+  useMemo,
+  useState,
+  type ReactNode,
+} from 'react';
+import { useTranslation } from 'react-i18next';
+import { useOrganization } from '../context/OrganizationContext';
+import { useBaseUrl } from '../context/BaseUrlContext';
+import { useAuth } from '../context/AuthContext';
+import { ProfileSwitchProvider } from '../context/ProfileSwitchContext';
+import { PCLoader } from '../ui';
+import { decodeJwtToken } from '../lib/utils';
+import { isSandboxMode } from '../lib/sandbox';
+import type {
+  GatePhase,
+  IdentityCandidate,
+  SelectUserGateProps,
+} from '../lib/types';
+import { PICKED_ORG_USER_KEY } from './constant';
+import { SelectUser } from './SelectUser';
+
+/**
+ * Shared-contact profile gate. On mount it asks the backend which principals
+ * share the signed-in contact; when more than one exists (and the session isn't
+ * already pinned to a chosen one), it renders the "choose your profile" picker
+ * instead of the consent view. Picking re-scopes the session via updateTokens,
+ * then renders children. It sits OUTSIDE DataAvailabilityProvider so no consent
+ * fetch runs against an unscoped token, and degrades to children on any error.
+ *
+ * Once resolved it also exposes `switchProfile` via ProfileSwitchContext, so a
+ * signed-in shared contact can re-open the picker and move to another profile.
+ */
+export const SelectUserGate = ({ children }: SelectUserGateProps) => {
+  const { t } = useTranslation();
+  const { organization } = useOrganization();
+  const organizationId = organization?.uuid || '';
+  const workspaceId = organization?.workspaces?.[0]?.uuid || '';
+  const { consentClient } = useBaseUrl();
+  const { accessToken, updateTokens } = useAuth();
+
+  const [phase, setPhase] = useState<GatePhase>('checking');
+  const [candidates, setCandidates] = useState<IdentityCandidate[]>([]);
+  const [busyOrgUserId, setBusyOrgUserId] = useState<string | null>(null);
+  const [selectError, setSelectError] = useState<string | null>(null);
+
+  // The token's principal. Routine refreshes (checkAndRefreshAuth,
+  // refreshOtpToken) hand back a fresh token string for the SAME principal;
+  // keying the gate check off this decoded id rather than the raw token keeps
+  // those refreshes from re-running the check and flashing the picker/spinner.
+  const tokenOrgUserId =
+    (decodeJwtToken(accessToken)?.user_data?.org_user_id as string) || '';
+
+  useEffect(() => {
+    let cancelled = false;
+
+    // Sandbox PoC: there is no JWT and no shared-contact concept — the subject is
+    // fixed by props. Skip the identity lookup and render children directly.
+    if (isSandboxMode()) {
+      setPhase('resolved');
+      return;
+    }
+
+    if (!organizationId || !workspaceId || !accessToken) {
+      setPhase('resolved');
+      return;
+    }
+
+    // Already pinned to a chosen principal this session? Pass straight through
+    // to children — but STILL resolve the sibling list in the background so the
+    // user menu can offer "switch profile". The default/unscoped token has
+    // org_user_id = the contact and no stored pick, so the picker still shows.
+    const picked =
+      typeof window !== 'undefined'
+        ? sessionStorage.getItem(PICKED_ORG_USER_KEY)
+        : null;
+    const isPinned = Boolean(picked) && picked === tokenOrgUserId;
+
+    // Only block on the spinner when the picker might actually open; a pinned
+    // session renders children immediately and resolves siblings quietly.
+    setPhase(isPinned ? 'resolved' : 'checking');
+    (async () => {
+      try {
+        const res = await consentClient.listIdentities({
+          organisationUuid: organizationId,
+          workspaceUuid: workspaceId,
+          authToken: accessToken,
+        });
+        if (cancelled) {
+          return;
+        }
+        const list = res?.identities ?? [];
+        setCandidates(list);
+        if (list.length > 1 && !isPinned) {
+          setPhase('picking');
+        } else {
+          setPhase('resolved');
+        }
+      } catch {
+        // Ledger/endpoint unavailable — never block the Privacy Center.
+        if (!cancelled) {
+          setCandidates([]);
+          setPhase('resolved');
+        }
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+    // consentClient is a stable factory result; re-running on its identity would
+    // risk a loop. Re-evaluate only when the tenant or the token's principal
+    // changes — not on every raw-token refresh. accessToken is read inside for
+    // the fetch but intentionally omitted so same-principal refreshes are no-ops.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [organizationId, workspaceId, tokenOrgUserId]);
+
+  const handleSelect = async (principalUuid: string) => {
+    if (!principalUuid || busyOrgUserId) {
+      return;
+    }
+    setBusyOrgUserId(principalUuid);
+    setSelectError(null);
+    try {
+      const res = await consentClient.selectPrincipal(
+        {
+          organisationUuid: organizationId,
+          workspaceUuid: workspaceId,
+          authToken: accessToken,
+        },
+        principalUuid,
+      );
+      if (!res?.token || !res?.refresh_token) {
+        throw new Error('select-principal returned no tokens');
+      }
+      // The picker selects by opaque uuid, but the "already pinned" check
+      // compares against the token's own org_user_id. Derive the pin from the
+      // NEW token so it matches on later reloads — it's the signed-in
+      // principal's own id, not a co-principal's, so nothing leaks.
+      if (typeof window !== 'undefined') {
+        const pinnedOrgUserId = decodeJwtToken(res.token)?.user_data
+          ?.org_user_id as string | undefined;
+        if (pinnedOrgUserId) {
+          sessionStorage.setItem(PICKED_ORG_USER_KEY, pinnedOrgUserId);
+        }
+      }
+      // Resolve before swapping the token so the picker doesn't flash back.
+      setPhase('resolved');
+      updateTokens(res.token, res.refresh_token);
+    } catch {
+      setBusyOrgUserId(null);
+      setSelectError(t('couldNotSwitchProfile'));
+    }
+  };
+
+  // Re-open the picker so a shared contact can move to another of its profiles.
+  // Drops the session pin and shows the picker with the already-loaded
+  // candidates; picking re-scopes the token exactly like the first choice.
+  const switchProfile = useCallback(() => {
+    if (typeof window !== 'undefined') {
+      sessionStorage.removeItem(PICKED_ORG_USER_KEY);
+    }
+    setSelectError(null);
+    setBusyOrgUserId(null);
+    setPhase('picking');
+  }, []);
+
+  const switchValue = useMemo(
+    () => ({ canSwitch: candidates.length > 1, switchProfile }),
+    [candidates.length, switchProfile],
+  );
+
+  let inner: ReactNode;
+  if (phase === 'checking') {
+    inner = (
+      <div className="pc-select-user-loading">
+        <PCLoader variant="spinner" color="info" size="lg" />
+      </div>
+    );
+  } else if (phase === 'picking') {
+    inner = (
+      <SelectUser
+        candidates={candidates}
+        onSelect={handleSelect}
+        busyOrgUserId={busyOrgUserId}
+        error={selectError}
+      />
+    );
+  } else {
+    inner = <>{children}</>;
+  }
+
+  return <ProfileSwitchProvider value={switchValue}>{inner}</ProfileSwitchProvider>;
+};

package/src/RedactoPrivacyCenter/components/constant.ts

@@ -39,3 +39,14 @@ export const MARKER_TINT: Record<BadgeVariant, MarkerTint> = {
 // Internal error thrown when an activity page fails to load (surfaced to the
 // user via the i18n `failedToFetchActivityData` toast).
 export const ACTIVITY_FETCH_ERROR_MESSAGE = 'Failed to fetch activity data';
+
+// ─── Shared-contact profile picker ───────────────────────────────────────────
+
+// sessionStorage key pinning the principal the user chose this session, so
+// routine token refreshes skip the picker.
+export const PICKED_ORG_USER_KEY = 'pc_picked_org_user_id';
+
+// The shared-contact picker/switch user-facing strings are localized via i18n —
+// see the chooseYourProfile / loginIdentifierLinkedToMultipleProfiles /
+// signingInEllipsis / couldNotSwitchProfile / switchProfile keys in
+// locales/*/translation.json.

package/src/RedactoPrivacyCenter/components/groupHelpers.ts

@@ -1,17 +1,21 @@
+import { LEGACY_PRODUCT_GROUP_UUID } from '../lib/constants';
 import type {
   ConsentDataElement,
   ConsentGroup,
   DataElement,
+  FormData,
   FormProductGroup,
   Purpose,
   PurposeItem,
 } from '../lib/types';
 
 /**
- * Map a Go-ledger `ConsentGroup` (from the user-consents endpoint) onto the
- * DSAR request form's `FormProductGroup`. Approach A: the request-form product
- * picker is now sourced from the ledger instead of Python's `form/data`, since
- * consents live in the ledger after the cutover.
+ * Map a `ConsentGroup` (from the user-consents endpoint — served by the Go
+ * ledger, or by Python's `/dsar/privacy-center/user-consents` when no
+ * ledgerBaseUrl is configured) onto the DSAR request form's
+ * `FormProductGroup`. Approach A: the request-form product picker is sourced
+ * from user-consents instead of Python's `form/data`, since after the cutover
+ * `form/data` no longer emits product groups.
  *
  * The shapes are near-identical; the only adaptations are:
  * - purpose id rename: ledger `purpose_uuid` -> form `uuid` (which the picker
@@ -36,8 +40,11 @@ export const consentGroupToFormProductGroup = (
 });
 
 const purposeItemToFormPurpose = (purpose: PurposeItem): Purpose => ({
-  uuid: purpose.purpose_uuid,
-  purpose_uuid: purpose.purpose_uuid,
+  // The ledger keys purposes as `purpose_uuid`; the legacy Python
+  // user-consents payload keys some of them as `uuid`. Accept either so the
+  // picker and the submitted `purpose_uuid` resolve on both backends.
+  uuid: purpose.purpose_uuid ?? purpose.uuid ?? '',
+  purpose_uuid: purpose.purpose_uuid ?? purpose.uuid ?? '',
   name: purpose.name,
   description: purpose.description ?? '',
   industries: '',
@@ -51,6 +58,35 @@ const purposeItemToFormPurpose = (purpose: PurposeItem): Purpose => ({
   ),
 });
 
+/**
+ * Build a single synthetic product group from a backend's legacy flat
+ * `form/data.purposes` list.
+ *
+ * Used as the last fallback for the DSAR picker: pre-grouping Python
+ * deployments (and the popup / case-management contexts, which resolve an
+ * arbitrary contact that the JWT-scoped user-consents endpoint cannot serve)
+ * return purposes without any product grouping. Rendering them under one
+ * group keeps the picker usable instead of showing "No products available"
+ * while the response actually carries consents — it is the lone group, so the
+ * product-selection step is skipped and the purpose list renders directly,
+ * matching the pre-grouping UX.
+ *
+ * The group carries `LEGACY_PRODUCT_GROUP_UUID`, which the submit path uses to
+ * omit the product anchor (there is no real product to scope the case to).
+ */
+export const legacyFlatGroup = (
+  form: FormData,
+  label: string,
+): FormProductGroup => ({
+  product_uuid: LEGACY_PRODUCT_GROUP_UUID,
+  product_name: label,
+  product_description: null,
+  nominator: null,
+  purposes: (form.purposes ?? [])
+    .map((wrapper) => wrapper?.purpose)
+    .filter((purpose): purpose is Purpose => Boolean(purpose)),
+});
+
 const consentDataElementToFormDataElement = (
   element: ConsentDataElement,
 ): DataElement => ({

package/src/RedactoPrivacyCenter/context/AuthContext.tsx

@@ -1,17 +1,74 @@
-import { createContext, useContext, useState, useEffect, useCallback, useMemo, type ReactNode } from 'react';
+import { createContext, useContext, useState, useEffect, useCallback, useMemo } from 'react';
 import { setRefreshTokenCookie, decodeJwtToken, resolveContactFromJwt, setSessionExpiredListener } from '../lib/utils';
-import type { AuthContextValue } from './types';
+import { setSandboxConfig } from '../lib/sandbox';
+import type {
+  AuthContextValue,
+  AuthProviderProps,
+  SeedSessionStorageData,
+} from './types';
 
 export type { AuthContextValue } from './types';
 
 const AuthContext = createContext<AuthContextValue | null>(null);
 
-interface AuthProviderProps {
-  children: ReactNode;
-  accessToken: string;
-  refreshToken: string;
-  onError: (error: Error) => boolean;
-}
+/**
+ * Raw sessionStorage writer for the five keys the Privacy Center reads
+ * (access_token / pc_org_id / pc_workspace_id / pc_org_slug / email). Single
+ * source of truth for those key names so the JWT and sandbox seeding paths can
+ * never drift. Each key is written only when its value is a non-empty string;
+ * `accessToken` is optional because the JWT path stores it separately. The
+ * `contact` value goes under the `email` key even when it is a mobile number
+ * (matching resolveContactFromJwt, which also stores mobile/org_user_id
+ * subjects there). No-ops when `window` is unavailable (SSR).
+ */
+const seedSessionStorage = (data: SeedSessionStorageData): void => {
+  if (typeof window === 'undefined') {
+    return;
+  }
+  if (data.accessToken) sessionStorage.setItem('access_token', data.accessToken);
+  if (data.orgId) sessionStorage.setItem('pc_org_id', data.orgId);
+  if (data.workspaceId) sessionStorage.setItem('pc_workspace_id', data.workspaceId);
+  if (data.slug) sessionStorage.setItem('pc_org_slug', data.slug);
+  if (data.contact) sessionStorage.setItem('email', data.contact);
+};
+
+/**
+ * Seed the sessionStorage keys the Privacy Center reads (org/workspace/slug/
+ * email/access_token) from the sandbox props and register the module-level
+ * sandbox config, so the fetch + auth layers switch to sandbox headers and skip
+ * token refresh. Returns true when sandbox mode was configured.
+ */
+const configureSandbox = (props: AuthProviderProps): boolean => {
+  const token = props.token?.trim();
+  if (!token) {
+    setSandboxConfig(null);
+    return false;
+  }
+
+  const organisationUuid = props.organisationUuid?.trim() ?? '';
+  const workspaceUuid = props.workspaceUuid?.trim() ?? '';
+  const ucic = props.sandboxUcic?.trim() ?? '';
+  const subject = props.sandboxSubject?.trim() ?? '';
+  const slug = props.slug?.trim() ?? '';
+
+  setSandboxConfig({
+    token,
+    ucic: ucic || undefined,
+    subject,
+    organisationUuid,
+    workspaceUuid,
+    slug,
+  });
+
+  seedSessionStorage({
+    accessToken: token,
+    orgId: organisationUuid,
+    workspaceId: workspaceUuid,
+    slug,
+    contact: ucic || subject,
+  });
+  return true;
+};
 
 /**
  * Extract and store organization/auth data from JWT token to sessionStorage
@@ -31,55 +88,68 @@ const syncJwtDataToSessionStorage = (accessToken: string): void => {
   const contact = resolveContactFromJwt(decoded)
     || sessionStorage.getItem('email')
     || (typeof localStorage !== 'undefined' ? localStorage.getItem('userEmail') : null);
-  if (contact && typeof contact === 'string') {
-    sessionStorage.setItem('email', contact);
-  }
 
-  // Extract organization UUID
-  const orgUuid = decoded.organisation_uuid;
-  if (orgUuid && typeof orgUuid === 'string') {
-    sessionStorage.setItem('pc_org_id', orgUuid);
-  }
-
-  // Extract workspace UUID
-  const workspaceUuid = decoded.workspace_uuid;
-  if (workspaceUuid && typeof workspaceUuid === 'string') {
-    sessionStorage.setItem('pc_workspace_id', workspaceUuid);
-  }
-
-  // Extract organization slug
-  const orgSlug = decoded.organisation_slug;
-  if (orgSlug && typeof orgSlug === 'string') {
-    sessionStorage.setItem('pc_org_slug', orgSlug);
-  }
+  // The access_token is stored separately by the caller (state initializer /
+  // updateTokens), so it is intentionally omitted here.
+  seedSessionStorage({
+    orgId: typeof decoded.organisation_uuid === 'string' ? decoded.organisation_uuid : undefined,
+    workspaceId: typeof decoded.workspace_uuid === 'string' ? decoded.workspace_uuid : undefined,
+    slug: typeof decoded.organisation_slug === 'string' ? decoded.organisation_slug : undefined,
+    contact: typeof contact === 'string' ? contact : undefined,
+  });
 };
 
-export const AuthProvider = ({
-  children,
-  accessToken: initialAccessToken,
-  refreshToken: initialRefreshToken,
-  onError,
-}: AuthProviderProps) => {
+export const AuthProvider = (props: AuthProviderProps) => {
+  const {
+    children,
+    accessToken: initialAccessToken,
+    refreshToken: initialRefreshToken,
+    token: sandboxToken,
+    sandboxUcic,
+    sandboxSubject,
+    organisationUuid,
+    workspaceUuid,
+    slug,
+    onError,
+  } = props;
+
+  // Sandbox PoC: configure the module singleton + seed sessionStorage BEFORE any
+  // child renders (same reason the JWT sync runs in the state initializer). This
+  // MUST run during render, not in a useEffect: child effects (which fire the
+  // first data fetch and read `sandboxAuthHeaders()` synchronously) run on commit
+  // BEFORE the parent's effects, so an effect here would configure the singleton
+  // too late. A useState lazy initializer runs once on the first render, ahead of
+  // any child, and is not re-run on subsequent parent re-renders — so it sets the
+  // config before the first fetch without the every-render side effect. When
+  // active, the JWT path below is skipped entirely.
+  const [sandboxActive] = useState(() => configureSandbox(props));
+
   // Sync to sessionStorage synchronously during initialization so child
   // components (ConsentManager, SideBarPC) find the data when they mount.
   // useEffect runs AFTER children render — too late for components that
   // read sessionStorage during their render phase.
   const [accessToken, setAccessToken] = useState(() => {
+    if (sandboxActive) {
+      return sandboxToken ?? '';
+    }
     if (initialAccessToken && typeof initialAccessToken === 'string' && initialAccessToken.trim() !== '') {
       if (typeof window !== 'undefined') {
         sessionStorage.setItem('access_token', initialAccessToken);
         syncJwtDataToSessionStorage(initialAccessToken);
       }
     }
-    return initialAccessToken;
+    return initialAccessToken ?? '';
   });
   const [refreshToken, setRefreshToken] = useState(() => {
+    if (sandboxActive) {
+      return '';
+    }
     if (initialRefreshToken && typeof initialRefreshToken === 'string' && initialRefreshToken.trim() !== '') {
       if (typeof window !== 'undefined') {
         setRefreshTokenCookie(initialRefreshToken);
       }
     }
-    return initialRefreshToken;
+    return initialRefreshToken ?? '';
   });
 
   // Terminal "session expired" flag. Set by utils' refresh routines (via the
@@ -97,8 +167,12 @@ export const AuthProvider = ({
     return () => setSessionExpiredListener(null);
   }, [markSessionExpired]);
 
-  // Re-sync when props change (for token refresh scenarios)
+  // Re-sync when props change (for token refresh scenarios). Sandbox mode has no
+  // JWT and no refresh, so these are no-ops there.
   useEffect(() => {
+    if (sandboxActive) {
+      return;
+    }
     if (initialAccessToken && typeof initialAccessToken === 'string' && initialAccessToken.trim() !== '') {
       setAccessToken(initialAccessToken);
       if (typeof window !== 'undefined') {
@@ -106,9 +180,12 @@ export const AuthProvider = ({
         syncJwtDataToSessionStorage(initialAccessToken);
       }
     }
-  }, [initialAccessToken]);
+  }, [initialAccessToken, sandboxActive]);
 
   useEffect(() => {
+    if (sandboxActive) {
+      return;
+    }
     if (initialRefreshToken && typeof initialRefreshToken === 'string' && initialRefreshToken.trim() !== '') {
       setRefreshToken(initialRefreshToken);
       // A fresh refresh token means the user re-authenticated — clear the
@@ -118,7 +195,22 @@ export const AuthProvider = ({
         setRefreshTokenCookie(initialRefreshToken);
       }
     }
-  }, [initialRefreshToken]);
+  }, [initialRefreshToken, sandboxActive]);
+
+  // Sandbox PoC: re-configure the module singleton when the sandbox inputs
+  // change after mount (the lazy initializer above only runs once, on first
+  // render — this mirrors the JWT re-sync effects for prop changes). Clears the
+  // singleton on unmount so a later JWT-mode mount never inherits a stale sandbox
+  // config. First-fetch ordering is unaffected: the initializer already set the
+  // config before any child effect ran.
+  useEffect(() => {
+    if (!sandboxActive) {
+      return;
+    }
+    configureSandbox(props);
+    return () => setSandboxConfig(null);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [sandboxActive, sandboxToken, sandboxUcic, sandboxSubject, organisationUuid, workspaceUuid, slug]);
 
   // Internal method to update tokens after refresh
   const updateTokens = useCallback((newAccessToken: string, newRefreshToken?: string) => {

package/src/RedactoPrivacyCenter/context/BaseUrlContext.tsx

@@ -13,7 +13,7 @@ export const BaseUrlProvider = ({
 }: {
   children: ReactNode;
   baseUrl: string; // Consent server base URL
-  ledgerBaseUrl: string; // Go ledger base URL — serves user-consents
+  ledgerBaseUrl?: string; // Go ledger base URL — serves user-consents
 }) => {
   const consentClient = useMemo(
     () => createConsentClient(baseUrl, ledgerBaseUrl),

package/src/RedactoPrivacyCenter/context/ProfileSwitchContext.tsx

@@ -0,0 +1,15 @@
+import { createContext, useContext } from 'react';
+import type { ProfileSwitchValue } from '../lib/types';
+
+// Lets any descendant of SelectUserGate (e.g. the user menu) re-open the
+// shared-contact profile picker. Defaults to a no-op so consumers rendered
+// outside the gate degrade gracefully.
+const ProfileSwitchContext = createContext<ProfileSwitchValue>({
+  canSwitch: false,
+  switchProfile: () => {},
+});
+
+export const ProfileSwitchProvider = ProfileSwitchContext.Provider;
+
+export const useProfileSwitch = (): ProfileSwitchValue =>
+  useContext(ProfileSwitchContext);

package/src/RedactoPrivacyCenter/context/types.ts

@@ -1,5 +1,43 @@
+import type { ReactNode } from 'react';
 import type { createConsentClient } from '../api/client';
 
+export type AuthProviderProps = Readonly<{
+  children: ReactNode;
+  accessToken?: string;
+  refreshToken?: string;
+  /**
+   * Sandbox PoC: when set, the Privacy Center skips the JWT entirely — it seeds
+   * org/workspace/subject from the props below, sends the single
+   * `X-Consent-Token` header, carries the acting identity in each request's own
+   * payload, and never calls `/otp/refresh`.
+   */
+  token?: string;
+  /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence over the subject. */
+  sandboxUcic?: string;
+  /** Sandbox subject (email or mobile) — carried in the request payload. */
+  sandboxSubject?: string;
+  /** Sandbox org UUID (replaces the JWT-decoded org). */
+  organisationUuid?: string;
+  /** Sandbox workspace UUID (replaces the JWT-decoded workspace). */
+  workspaceUuid?: string;
+  /** Organisation slug — used to seed sandbox sessionStorage. */
+  slug?: string;
+  onError: (error: Error) => boolean;
+}>;
+
+/**
+ * The five-key sessionStorage payload the Privacy Center seeds (access_token /
+ * pc_org_id / pc_workspace_id / pc_org_slug / email). `contact` lands under the
+ * `email` key even when it is a mobile/UCIC subject.
+ */
+export type SeedSessionStorageData = {
+  accessToken?: string;
+  orgId?: string;
+  workspaceId?: string;
+  slug?: string;
+  contact?: string;
+};
+
 export type AuthContextValue = Readonly<{
   accessToken: string;
   refreshToken: string;
@@ -14,6 +52,6 @@ export type AuthContextValue = Readonly<{
 
 export type BaseUrlContextValue = Readonly<{
   baseUrl: string;
-  ledgerBaseUrl: string;
+  ledgerBaseUrl?: string;
   consentClient: ReturnType<typeof createConsentClient>;
 }>;

package/src/RedactoPrivacyCenter/lib/api.ts

@@ -394,6 +394,7 @@ export const manageConsent = async ({
   productUuid,
   noticeUuid,
   dataElements,
+  language,
 }: {
   organizationId: string;
   workspaceId: string;
@@ -407,6 +408,7 @@ export const manageConsent = async ({
   productUuid?: string;
   noticeUuid?: string;
   dataElements?: Array<{ uuid: string; selected: boolean }>;
+  language?: string;
 }): Promise<boolean | null> => {
   try {
     // Ensure we have a valid token before making the API call
@@ -429,6 +431,7 @@ export const manageConsent = async ({
       productUuid,
       noticeUuid,
       dataElements,
+      language,
     });
     return result;
   } catch (error: any) {

package/src/RedactoPrivacyCenter/lib/constants.ts

@@ -40,7 +40,6 @@ export const languageOptions = [
   { value: 'mni-Mtei', label: 'ꯃꯩꯇꯩꯂꯣꯟ (Manipuri)' },
   { value: 'gom', label: 'कोंकणी (Goan Konkani)' },
   { value: 'sa', label: 'संस्कृतम् (Sanskrit)' },
-  { value: 'bho', label: 'भोजपुरी (Bhojpuri)' },
   { value: 'brx', label: 'बड़ो (Bodo)' },
   { value: 'ks', label: 'كٲشُر (Kashmiri)' },
   { value: 'sat', label: 'ᱥᱟᱱᱛᱟᱲᱤ (Santali)' },
@@ -198,13 +197,20 @@ export const LEGACY_REFRESH_TOKEN_COOKIE = 'refresh_token';
 
 // ─── DSAR request form ─────────────────────────────────────────────────────
 
-// Max product groups requested from the Go ledger's user-consents when
-// sourcing the DSAR request-form product picker (Approach A). The ledger caps
-// user-consents page size at 100; the picker needs all of a principal's
-// groups, so we request the max. A principal with >100 product groups would
-// need group-level pagination (follow-up).
+// Max product groups requested from user-consents when sourcing the DSAR
+// request-form product picker (Approach A). The Go ledger caps user-consents
+// page size at 100; the picker needs all of a principal's groups, so we
+// request the max. A principal with >100 product groups would need
+// group-level pagination (follow-up).
 export const FORM_PICKER_GROUP_LIMIT = 100;
 
+// Sentinel `product_uuid` of the synthetic product group the DSAR picker
+// builds from a backend's legacy flat `purposes` list (pre-grouping Python
+// deployments, and the popup / case-management contexts that cannot read
+// user-consents). It is a client-side construct with no server counterpart,
+// so a case raised from it must be submitted without a product anchor.
+export const LEGACY_PRODUCT_GROUP_UUID = '__legacy_flat_purposes__';
+
 // ─── Notification Hub ──────────────────────────────────────────────────────
 
 export const POLL_INTERVAL = 30_000;